0

我正在创建一个 cloudformation 堆栈，其中模板创建 Cloud Trail，然后创建 S3 存储桶并将所有日志推送到 S3 存储桶。

我已尝试创建 Cloud trail、s3 存储桶并尝试将 s3 存储桶策略附加到存储桶

Parameters:
    loggroupname: 
      Type: String
    trailname:
      Type: String
    s3bucketname:
      Type: String
Resources:
    createloggroup:
      Type: AWS::Logs::LogGroup
      Properties:
        LogGroupName: !Sub ${loggroupname}
    creates3bucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: !Sub ${s3bucketname}
    s3bucketpolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: !Sub ${s3bucketname}
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Sid: 'AWSCloudTrailAclCheck20150319'
              Effect: 'Allow'
              Principal: 
                  Service: 'cloudtrail.amazonaws.com'
              Action: 's3:GetBucketAcl'
              Resource: 
                !Sub 'arn:aws:s3:::${s3bucketname}'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Sid: AWSCloudTrailWrite20150319
              Effect: 'Allow'
              Principal: 
                  Service: 'cloudtrail.amazonaws.com'
              Action: 's3:PutObject'
              Resource: 
                !Sub 'arn:aws:s3:::${s3bucketname}/AWSLogs/${AWS::AccountId}/*'
              Condition:
                StringsEquals: 
                    s3:x-amz-acl: 'bucket-owner-full-control'
    myvpctrail:
      DependsOn:
        - s3bucketpolicy
      Type: AWS::CloudTrail::Trail
      Properties:
        IsLogging: true
        IsMultiRegionTrail: true
        IncludeGlobalServiceEvents: true
        S3BucketName: !Ref creates3bucket

无效条件类型：StringsEquals（服务：Amazon S3；状态代码：400；错误代码：MalformedPolicy；请求 ID：F7439B111E82A3FA；S3 扩展请求 ID：IGU1L7BB77WcrhPtmydd5j6viQdMK0vqA3Qo4RTS209FAvjT3q6wBIsyabdt5B7pBFvdr2MT+sM=）

4

1 回答 1

2

简单的错字。

它是StringEquals而不是 StringsEquals。

资料来源：https ://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html

于 2019-08-20T23:37:15.897 回答